TL;DR
LoRa and Meshtastic:
- GhostESP can now talk to Meshtastic and Meshcore networks over SX1262 LoRa radios.
- The official Meshtastic and Meshcore apps work with it over BLE.
- LoRa is supported on the Heltec V3 and LilyGo T-Deck.
- LoRa is also supported on the CrowPanel Advance 2.4/2.8/4.3-inch and the CrowPanel Advanced P4 7/9/10.1-inch.
Bluetooth:
- The BLE device detect scan now has its own CLI command and menu row.
- It recognises many more devices: Tile, Samsung SmartTag, Chipolo, AirPods, Apple Watch, FindMy clones, Fast Pair / Find Hub accessories, hearing aids, exposure beacons, and Chameleon Ultra.
- Dual BLE + Wi-Fi wardriving (
dualwd) is available on PSRAM boards.
Wi-Fi and captures:
- You can set your own channel hopping list for attacks, scans, the airspace monitor, and packet hopping.
- You can pick your country in Settings > Wi-Fi.
- Captures now include signal, channel, and rate info, so Wireshark shows per-frame radio details.
- Captures now include VLAN-tagged traffic and control frames.
- Several capture bugs that dropped or mangled frames are fixed.
- A new
mdnssniffcommand passively learns local device names (mDNS, LLMNR, SSDP, NetBIOS).
Apps and hardware:
- New Game Boy / Game Boy Color emulator with save states.
- The Apps gallery now has folders: Tools, System, Games, Communication, Media, and Sensors.
- The plugin API gained faster menus and a native options list.
- The T-Deck can now play audio.
- ESP32-S3 boards with an SD card can expose it over USB.
- The Elecrow CrowPanel 1.28-inch rotary display is supported.
- IR TX/RX pins can now be changed at runtime.
UI:
- A clock in the status bar.
- Analog and seven-segment clock faces.
- A restyled on-screen keyboard.
- Reorganised Settings and a new Row Height setting.
- Subfolder navigation in IR, NFC, SubGHz, Evil Portal, Favorites and BadUSB.
- The lockscreen is on by default.
Reliability:
- Lower RAM use in GhostScript and wardriving.
- About 15KB of RAM freed at boot on classic ESP32 boards.
- Fixes for S3TWatch USB, battery, backlight and RTC.
- Fixes for the web UI and C5 Wi-Fi scanning.
- Several memory leaks fixed.
Added
Clock & Time
- Added a clock to the centre of the status bar, toggleable in Settings > Date & Time
- Added switchable analog and seven-segment clock faces to the Clock view
LoRa & Meshtastic
- Added Meshtastic and Meshcore-compatible LoRa support for SX1262 radios, including BLE app support with the official Meshtastic and Meshcore Apps
- Added LoRa support to Heltec V3, LilyGo TDeck, Elecrow CrowPanel Advance 2.4/2.8/4.3-inch, and CrowPanel Advanced P4 7/9/10.1-inch
Wi-Fi & Networking
- Added a custom channel hopping setting for attacks, AP and station scans, airspace monitor, and packet hopping
- Added a Country selector to Settings > Wi-Fi
- Added
mdnssniffpassive local-name sniffer (mDNS/LLMNR/SSDP/NetBIOS) per ARP-discovered host
Captures & Wireshark
- Added signal, channel and rate to captures so Wireshark shows per-frame radio info
- Added 802.1Q/QinQ tag support so VLAN-tagged traffic and handshakes are recognised
- Added control frames (RTS/CTS/ACK/Block Ack) to the EAPOL and Wireshark captures
Bluetooth & BLE
- Added a
bledetectCLI command and Devices menu row for the device detect scan, with list, track and AirTag spoof actions - Added a
-name <text>argument toblespamto advertise a custom name - Added more devices to the BLE detect scan
- Tile trackers. Adapted from Flock-You-Android and Silabs
- Samsung SmartTag. Adapted from arxiv 2210.14702 and adwatch
- Chipolo
- Apple AirPods with per-model variants. Adapted from Theengs and Bruce ble_spam
- Apple Watch. Adapted from Theengs
- Generic FindMy clones
- Fast Pair / Find Hub accessories. Adapted from the Google spec
- Hearing aids. Adapted from Android docs
- Exposure beacons. Adapted from Theengs
- Chameleon Ultra. Adapted from Nordic docs
GPS & Wardriving
- Added
dualwdBLE + WiFi coexistence wardriving (PSRAM devices only) to the CLI and GPS menu
Apps & Plugin API
- Added a Game Boy / Game Boy Color emulator app with save states and battery saves
- Added an embeddable native options list to the plugin API, plus widget rects, design metrics, a page stack and raw touch state
- Added batched plugin UI calls for faster plugin menus:
ui_obj_get_rectsandui_obj_apply_props - Added a
forward_backmanifest option so plugin apps can handle BACK themselves, andGHOSTESP_API_HAS()for feature-gating plugin API fields - Added
Tools,System,Games,Communication,MediaandSensorsfolders to the Apps gallery, shared with SD apps by their manifestcategory
Hardware Support
- Added Audio Player support to the LilyGo T-Deck via its onboard MAX98357A speaker amp
- Added USB SD card passthrough on ESP32-S3 boards with an SD card
- Added Elecrow CrowPanel 1.28-inch rotary display support with USB Audio volume/mute control
- Added runtime IR TX/RX pin configuration through the CLI or the settings menu
UI & Settings
- Added a Row Height setting for the options menus
Diagnostics
- Added a
glbenchCLI command and Settings > Tools row to benchmark GhostLink throughput and view link statistics
Changed
UI & Navigation
- Added subfolder navigation to IR Remotes and Universals, NFC Saved/Write/Emulate, SubGHz Saved, Evil Portal, Favorites and BadUSB, with full paths for nested files and pagination in Favorites and BadUSB
- Enabled the lockscreen by default with no PIN on fresh installs
- Renamed the SD browser's bottom Back row to Exit
- Restyled the on-screen keyboard with a standard iOS-style layout
- Defaulted the terminal to white small text with padding, spacing and colour-coded output
- Reorganized Settings menu categories for easier navigation
- Improved encoder navigation in grid app menus
- Added a T-Embed detent mode setting
- Improved the Track RSSI readout with a warmer/colder trend arrow
- Standardized the bottom touch bar, back-key handling, list/log scrolling and view layout with shared helpers
- Wi-Fi and Bluetooth scan results page with
< Prev/Next >rows - Mapped IR buttons to the theme palette
- Matched the Ethernet dashboard status card to the rounded action rows
- Sorted SD apps alphabetically instead of in card order
- Replaced the "SD apps ready" toast on Apps entry with a count in the status bar
Messaging & Output
- Reworded the deauth notice to say plainly whether the target will drop it, based on the network's security type
- Cleaned up boot and GhostLink console output
- Added periodic capture progress and shut up the PCAP writer HWM log
Performance & Memory
- Reduced GhostScript RAM use across all boards
- Reduced wardriving queue RAM use by 58% without reducing capture capacity
- Freed ~15KB of RAM at boot on classic ESP32 boards by releasing unused Classic Bluetooth memory at startup instead of on first BLE use
- Raised the Banshee GhostLink UART to 921600 baud with a larger receive buffer so the higher rate does not increase receive loss
Fixed
Wi-Fi & Scanning
- Fixed Wi-Fi country and channel handling to honor ESP-IDF channel limits, reject unsupported channels, and keep DFS channels out of active TX
- Fixed ESP-IDF 6.1 C5 dual-band bandwidth setup, monitor plans and passive DFS scans
- Fixed C5 station scans across AP/STA-to-promiscuous transitions
- Fixed Scan All on C5 showing no AP spinner, as the per-channel sweep blocked the UI task
- Fixed Scan All's station scan being cancelled by taps queued during the AP phase
- Fixed Wi-Fi Security Check freezing with no spinner and spamming Enter in the terminal
- Fixed the DNS server task overflowing its stack during Evil Portal sessions on non-PSRAM boards
- Fixed NM-CYD-C5 AP row crash
Captures & Packet Analysis
- Fixed the HT Control field being ignored on non-QoS data frames, which hid some ARP, EAP and IP traffic
- Capture summaries now report frames lost to an oversized buffer or a full queue instead of discarding them silently
- Fixed captures reporting success when an SD write fails
- Fixed corrupted frames in the Wireshark USB stream
- Fixed
capture -rawandcapture -wiresharkdropping data frames over 768 bytes, stripping the FCS only from some frame types, and discarding every ACK/CTS as too short - Fixed the Packet Visualiser "Channel Hopping" row being unselectable by touch and doing nothing
- Fixed Packet Visualiser selector rows being dead on touch boards other than CrowPanel P4
Web UI
- Fixed the web UI dashboard SD Card card never populating; it now shows mount status, path and used/total space
- Fixed the web UI dashboard "Remote CMD" field reading "No" while remote commands worked; it now shows Running/Idle as "Remote CMD Activity"
- Fixed the web UI sending Wi-Fi commands with SSIDs or passwords containing quotes or spaces, and made command arguments, long commands and oversized web UI payloads get validated instead of silently truncated
UI & Input
- Fixed empty options menus (Wi-Fi, Settings, BadUSB, NFC, SubGHz, and more)
- Fixed the setup wizard getting stuck on the country step, which looked like a freeze on keyboard-only devices
- Fixed excessive row padding in the setup wizard's country and option lists on small panels
- Fixed on-screen keyboard preview text scrolling vertically instead of horizontally
- Fixed the Row Height setting being ignored by scan result lists and Enter not opening their detail views
- Fixed AP/STA result rows rendering beneath the bottom touch bar
- Fixed lockscreen and GhostScript touch bar gaps on large screens
- Fixed detail titles always showing 'Details'
- Fixed detail view info labels being cut off instead of scrolling sideways when too wide
- Fixed touch-bar row passthrough
- Fixed encoder select in scan result lists
- Fixed T-Embed rotary encoder step rate and sensitivity
- Fixed main menu and Apps grid titles being unreadable over asset pack backgrounds
- Fixed BadBLE touch-drag scrolling
- Fixed BadBLE poll timer leak on exit
Apps & Plugins
- Fixed stuck on-screen buttons and swallowed touch releases in canvas-based plugin apps on non-P4 targets
- Fixed GhostScript crash when an event listener received an event
- Fixed SD apps built for another chip showing in the Apps gallery and then failing to launch
- Fixed Cloud Store install progress showing "0 KB downloaded" during the install phase
Hardware & Boards
- Fixed S3TWatch USB serial becoming unresponsive when the screen turns off
- Fixed repeated AXP2101 battery errors and invalid battery readings on S3TWatch
- Fixed S3TWatch backlight flickering instead of dimming in low power mode
- Fixed T-Watch S3 RTC using the wrong I2C bus and chip address
- Fixed RTC boot restore trusting an invalid (power-lost) oscillator time
- Fixed CrowPanel display startup configs
- Fixed Banshee GhostLink wardriving scans and S3 GPS fix selection
- Fixed ESP32-C5 merged firmware failing to boot when flashed at
0x0by placing the bootloader at the required0x2000offset - @yanxke (#395)
Memory & Stability
- Fixed memory and handle leaks in LVGL async calls, PSRAM task stacks, PCAP/wardrive CSV files, DIAL sessions and Chameleon/audio semaphores
Release: https://github.com/GhostESP-Revival/GhostESP/releases/tag/v2.2
Changelog: https://github.com/GhostESP-Revival/GhostESP/blob/v2.2/CHANGELOG.md
You can flash the bins with https://ghostesp.net/flasher